Executive brief
A security flaw in Microsoft .NET and Visual Studio could allow an attacker to tamper with files on a system. By sending a specially crafted file to an application using these tools, an attacker could write unauthorized files or directories to certain locations. While the attacker has limited control over where these files are placed, this could still disrupt operations or be used as a stepping stone for further system tampering.
Technical details
This vulnerability is classified as a path traversal issue (CWE-22/CWE-36) within .NET Core and related Visual Studio components. The root cause is improper validation of file paths when handling specially crafted files, which allows an authenticated attacker to write files or directories to unintended locations on the host filesystem. The attack vector is network-based, requiring the attacker to have low-level privileges and the ability to send a malicious file to the vulnerable system. While the attacker can write arbitrary data, they have limited control over the exact destination path. Microsoft has released security updates for .NET 8.0, 9.0, 10.0, and Visual Studio 2022/2026 to address this behavior.
Affected products
- Microsoft .NET 8.0 8.0.0 to 8.0.26
- Microsoft .NET 9.0 9.0.0 to 9.0.15
- Microsoft .NET 10.0 10.0.0 to 10.0.7
- Microsoft Visual Studio 2022 17.12.0 to 17.12.19, 17.14.0 to 17.14.31
- Microsoft Visual Studio 2026 18.5.0 to 18.5.2
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory